Using AppLocker to block applications on networks

Nailed Down

Article from ADMIN 09/2012

By Thomas Joos

AppLocker lets administrators of Windows Server 2008 R2 and Windows 7 use policies to block individual applications. This prevents users from smuggling in undesirable programs on USB sticks or by email.

Even if users don't have administrative privileges, they can still launch many programs without trouble; these programs possess the same privileges as their users and can transfer enterprise data to the web. Because of this, it makes sense to restrict the degree of freedom that users enjoy.

To use AppLocker (Figure 1), you must have Windows 7 Enterprise and Ultimate Edition client-side. AppLocker is also available in the Standard, Enterprise, and Datacenter Editions of Windows Server 2008 R2. The approach involves creating policies that are automatically applied to Windows 7 clients. Operating systems that are incompatible with AppLocker simply ignore the policies. There is no danger of disabling machines just because the operating system doesn't understand the AppLocker policies.

Figure 1: AppLocker lets you restrict the ability to execute programs on enterprise networks.

AppLocker also supports whitelists, blacklists, and combinations of rules. It can block applications and even individual DLL files in special use cases, including the ability to distinguish between program and DLL versions. AppLocker can also create automatic policies and monitor specific directories for new programs. Besides group policies, you can also filter via security groups, and with

...

Use Express-Checkout link below to read the full article (PDF).